CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99216?
CVE-2026-99216 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.
Which versions are affected by CVE-2026-99216?
How do I fix CVE-2026-99216?
Upgrade to a fixed version.
Is CVE-2026-99216 being exploited?
There is no known exploitation of CVE-2026-99216 in the wild and no public exploit code.
Sources
Also known as AZL-111386, BELL-CVE-2026-99216, DEBIAN-CVE-2026-99216, GHSA-rfjw-g695-7wxh, UBUNTU-CVE-2026-99216.